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Science  and  Technology  Law  Unit 
Office  of  General  Counsel 
Federal  Bureau  of  Investigation 


The  Law 


Title  III  & Electronic  Communications 

Protection  Act 

• Title  III,  18  use  sec.  2510,  Omnibus  Crime 
Control  and  Safe  Streets  Act,  Commonly 
referred  to  as  the  Wire  Tap  Act 

• As  amended  by  the  ECPA,  Title  III  prohibits 
the  interception  of  wire  and  oral 
communications,  and  electronic 
communications. 

• Provides  for  criminal  penalties  and  civil 
damages  against  anyone  who 
“intentionally  intercepts,  endeavors  to 
intercept”  any  covered  communication. 


Title  III  Order 


■ Under  Title  111,  the  govern nnent  may  apply  for  a court  order 
authorizing  an  interception.  18  U.S.C.  §2516(1) 

■ Application  must  specify  the  offense  being  investigated,  the 
nature  and  location  of  the  facilities  where  the 
communications  are  to  be  intercepted,  and  a particular 
description  of  the  communications  sought  to  be  intercepted. 
18  U.S.C.  §2518(1) 


■ Standard:  Probable  cause  to  believe  that  a particular  offense 
is  being  committed  and  that  targeting  the  specified  facility  will 
yield  communications  concerning  the  offense.  18  U.S.C.  § 
2518(3) 


Title  III  Order  (cont.) 


Good  for  up  to  thirty  days.  Extensions  allowed, 
but  same  standard  applies  to  extension.  18 
U.S.C.  §2518(5) 

Required  to  “minimize”  the  interception  unrelated 
to  criminal  activity.  18  U.S.C.  § 2518(5) 

Requires  a finding  that  normal  investigative 
procedures  are  unlikely  to  be  successtui  or  are 
too  dangerous.  18  U.S.C.  § 2518(3Xc) 

Requires  notice  to  the  target  within  90  days.  1 8 
U.S.C.  §2518(8)(d) 


Interception  v.  Search 


Title  III  real  time  interception  of  electronic 


Collection  of  stored  data  - a search  of 
memory 


Court  ordered  surveillance 


■ Government  must  certify  that  information 
is  likely  to  be  obtained  by  use  or  device  “is 
relevant  to  an  ongoing  criminal 
investigation.”  18  U.S.C.  § 3122(b)(2) 


What  is  the  Pen/Trap  “addressing  information 


■ Dialing,  Routing,  Addressing,  Signaling  Information 

■ Transmitted  by  Instrument  or  Facility  from  which  a 
Communication  is  Transmitted  (pen) 

■ Identifies  Originating  Number  or  Other  D/R/A/S  or  is 
Reasonably  Likely  to  Identify  the  Source  (trap) 

■ Utilized  in  Processing  or  Transmission  of 
Communications 

■ is  not  “Contents  of  any.. .Communications” 


■ Thou  shall  NOT  collect  the  Contents  of 
any  communication 

• 18  use  sec.  3121  (c)  - “use  technology 
reasonably  available  to  restrict ...  so  as 
not  to  include  the  contents  of  any  wire  or 
electronic  communications” 


stored  Communications  & Records 
ECPA  18  use  SEC.  2701 


Content  of  communication  in  “storage” 
Subscriber  Records 


Transactional  Records 


Unauthorized  Access  to  Stored 
Communications 

■ 18  use  § 2701  (Electronic  Communications 

Protection  Act) 

• Unauthorized  access  to  communications  in 
“electronic  storage”  {e.g.,  one  user  snooping  in 
another’s  inbox) 

- intentionally  access  without  authorization  a facility  through 
which  an  electronic  communication  service  is  provided  and 
thereby  obtain  a wire  or  electronic  communication  while  it  is 
in  electronic  storage.” 

• Inapplicable  when  authorized  by  the  Service 
Provider,  §2701  (c)(1) 

• Excepts  conduct  authorized  by  a “user”  of  that 
service  with  respect  to  a communication  of  or 
intended  for  that  user.  §2701  (c)(2) 


Disclosure  of  Stored  Content  & Records 


■ General  rule:  a public  provider  (e.g.,  an  ISP)  may 
not  freely  disclose  the  content  or  records  of  its 
customer’s  communications  to  others  [18  U.S.C.  § 
2702] 

■ Non-Public  Providers  may  voluntarily  disclose 
for  any  reason 


18  use  sec.  2703 


Required  disclosure  of  customer  communications 
(in  electronic  storage)  or  records 

Requires  search  warrant  (FRCP  41),  Federal 
subpoena,  or  Federal  court  order 

180  day  rule 


Notice  to  subscriber  or  customer 


What’s  a § 2703(d)  Court  Order? 


■ “Articulable  facts”  order 

• “Specific  and  articulable  facts  showing  that  there  are 
reasonable  grounds  to  believe  that  [the  specified 
records]  are  relevant  and  material  to  an  ongoing 
criminal  investigation” 

■ A lower  standard  than  probable  cause  but  higher 
than  pen/trap 

■ Notice  may  be  deiayed:  up  to  90  days  (may 
extend)  to  avoid  flight,  destruction  of  or 
tampering  with  evidence,  witness  intimidation, 
seriousiy  jeopardizing  an  investigation 


Nationwide  Search  Warrants  for  E-Mail: 


■ Investigators  may  use  section  2703(a)  warrants 
to  compel  disclosure  of  stored  communications 
from  providers  anywhere  in  the  country 

- Issued  “by  a court  with  jurisdiction  over  the 
offense  under  investigation” 

■ Consistent  with  use  of  federal  grand  jury 
subpoenas  and  orders  under  section  2703(d). 


Can  be  obtained  w/  Subpoena,  2703(d)  order,  or 
Search  warrant 

Provider  must  give  government: 

■ Name,  Address 

■ Local  and  long  distance  telephone  connection  records,  or  records  of  session 
times  and  durations: 

■ Length  of  service  (including  start  date)  and  types  of  service  utilized; 

■ Telephone  or  instrument  number  or  other  subscriber  number  or  identity, 
including  any  temporarily  assigned  network  address:  and 


Means  and  source  of  payment  for  such  service  (including  any  credit  card  or 
bank  account  number) 


Transactional  Data 


■ “A  record  or  other  information  pertaining  to  a 
subscriber  to  or  customer  of  such  service  (not 
including  the  contents  of  communications).” 

§ 2703(c)(1)  Everything  that’s  not  content  & not  subscriber 
information 


■ Example: 


- Cell-site  data; 

- AHrlrp<5«p<5  / lrlpntiti<=»s  nf  nnrmcnnnrIfantQ 

- Incoming  e-mail  traffic  information; 

- Account  logs  that  record  usage  e.g.,  ULRs  (web  surfing 
activity) 
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Use  § 2703(d)  order  to  collect  prospectively 


CONTACT  INFO 


Assistant  General  Counsel 
Office  of  the  General  Counsel 
Science  and  Technology  Law  Unit 


Wake  up. 

It’s  time  to  leave. 
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TOPICS 


■ General  guidelines 

■ The  Law  (e.g.,  Title  III) 

■ Pen  Register/  Trap  and  Trace 


■ Stored  Communications 

■ Computer  Trespasser  Exception 
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General  Operational 
Guidelines 


General  Operational 
Guidelines 


■ What  is  your  legal  authority? 


■ Law  Enforcement  Sensitive  (LES) 
collection  devices,  systems, 
techniques,  and  related  information 
are  not  to  be  disclosed.  Only  the 
product  of  the  technical  operation  is 
disclosed. 


■ Law  Enforcement  Sensitive 

Im  FOLIO  (For  Official  Use  Only)  - a caveat 
applied  to  sensitive  but  unclassified 
information  that  may  be  exempt  from 
release  under  FOIA 

H ■ LES  (Law  Enforcement  Sensitive)  is  another 
H of  9 potential  exemptions  under  FOIA  to 

protect  law  enforcement  sources  and 
methods,  evidence,  reports,  tools  and 
H techniques,  etc. 

H ■ FOUO/LES  is  unclassified  information 


Law  Enforcement  Sensitive 


■ Law  Enforcement  Sensitive  (LES) 
equipment  enjoys  "qualified  privilege" 

■ State/local  vs.  Federal  prosecutions 

■ Testimony  - how  to  ... 


The  Law 


■ Title  III  & Electronic  Communications 
Protection  Act 
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Control  and  Safe  Streets  Act,  Commonly 
referred  to  as  the  Wire  Tap  Act 

As  amended  by  the  ECPA,  Title  III  prohibits 
the  interception  of  wire  and  oral 
communications,  and  electronic 
communications. 


- Provides  for  criminal  penalties  and  civil 
damages  against  anyone  who  "intentionally 
intercepts,  endeavors  to  intercept"  any 
covered  communication. 


Under  Title  III,  the  government  may  apply  for  a 
court  order  authorizing  an  interception.  18 
U.S.C.  §2516(1) 
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investigated,  the  nature  and  location  of  the 
facilities  where  the  communications  are  to  be 
intercepted,  and  a particular  description  of  the 
communications  sought  to  be  intercepted.  18 


■ Standard:  Probable  cause  to  believe  that  a 
particular  offense  is  being  committed  and  that 
targeting  the  specified  facility  will  yield 
communications  concerning  the  offense.  18 
U.S.C.  § 2518(3) 
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Title  111  Order  (cont.) 
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allowed,  but  same  standard  applies  to 
extension.  18  U.S.C.  § 2518(5) 

Required  to  "minimize"  the  interception 
unrelated  to  criminal  activity.  18  U.S.C.  § 
2518(5) 

Requires  a finding  that  normal  investigative 
procedures  are  unlikely  to  be  successful  or 
are  too  dangerous.  18  U.S.C.  § 2518(3)(c) 


Ken  Register/ 
Trap  and  Trace 
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Government  must  certify  that 

i 

information  likely  to  be  obtained  by 
use  of  device  "is  relevant  to  an 
ongoing  criminal  investigation."  18 
U.S.C.  § 3122(b)(2) 


What  is  the  Pen/Trap 
'"addressing  information"? 


Dialing,  Routing,  Addressing,  Signaling 
Information 

Transmitted  by  Instrument  or  Facility  from  which 
a Communication  is  Transmitted  (outgoing  call) 
(pen) 

Identifies  Originating  Number  or  Other  D/R/A/S 
or  is  Reasonably  Likely  to  Identify  the  Source 


Limitation: 


■ Thou  shall  NOT  collect  the  Contents  of 


- 18  use  sec.  3121  (c)  - "use  technology 
reasonably  available  to  restrict ...  so  as 
not  to  include  the  contents  of  any  wire  or 
electronic  communications" 


- 18  use  sec.  3127  pen/trap  definition: 
"shall  not  include  the  contents  of  any 
communication" 
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Loan  of  ELSUR  in  Support  of 
Federal,  State,  and  Local  Requests 


for  Assistance 


lAG  Order  2954-2008 


stored  Communications  & Records 
ECPA  18  use  SEC.  2701 


"Electronic  storage"  is  defined  at  18  U.S.C.  § 2510(17) 
as:  (A)  any  temporary,  intermediate  storage  of  a wire  or 
electronic  communication  incidental  to  the  electronic 
transmission  thereof;  and  (B)  any  storage  of  such 
communication  by  an  electronic  communication  service 
for  purposes  of  backup  protection  of  such 


/f%  Disclosure  of  Stored  Content 
^ & Records 


■ General  rule:  a public  provider  {e.g.,  an  ISP) 
may  not  freely  disclose  the  content  or  records 
of  its  customer's  communications  to  others  [18 
U.S.C.  § 2702] 

■ Non-Public  Providers  may  voluntarily 
disclose  for  any  reason 


18  use  sec.  2703 

Requires  disclosure  of  customer 
communications  (in  electronic  storage)  or 
records 

Requires  search  warrant  (FRCP  41),  Federal 
subpoena,  or  Federal  court  order  (2703d 
order) 

180  day  rule 

Notice  to  subscriber  or  customer 


What's  a § 2703(d)  Court 
Order? 


"Articulable  facts"  order 

- "Specific  and  articulable  facts  showing  that  there  are 
reasonable  grounds  to  believe  that  [the  specified 
records]  are  relevant  and  material  to  an  ongoing 
criminal  investigation" 

A lower  standard  than  probable  cause  but 
higher  than  pen/trap 
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(may  extend)  to  avoid  flight,  destruction 
of  or  tampering  with  evidence,  witness 
intimidation,  seriously  jeopardizing  an 
investioation 
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Nationwide  Search  Warrants 
for  E-Mail: 


■ Investigators  may  use  section  2703(d) 
warrants  to  compel  disclosure  of  stored 
communications  from  providers  anywhere 
in  the  country 
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Basic  Subscriber  Information 


Can  be  obtained  w/  Subpoena,  2703(d)  order,  or 
Search  warrant,  consent 
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■ Name,  Address 

■ Local  and  long  distance  telephone  connection  records,  or  records 
of  session  times  and  durations: 

■ Length  of  service  (including  start  date)  and  types  of  service 

I 1 
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■ Telephone  or  instrument  number  or  other  subscriber  number  or 
identity,  including  any  temporarily  assigned  network  address:  and 

■ Means  and  source  of  payment  for  such  service  (including  any 
credit  card  or  bank  account  number) 


"A  record  or  other  information  pertaining  to  a 
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to  or  custoi  I ler  of  such  sorvico  (not 


including  the  contents  of  communications). 

§ 2703(c)(1)  (Everything  that's  not  content  & 
not  subscriber  information) 


Title  III  (18  U.S.C.  2511-17)  - Consent 
vs.  Computer  Trespasser  Exception 


■ Need  a court  order  to  monitor  the 
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an  exception  (consent). 

■ Content  includes: 


|l|  Relevant  Exceptions  to 
— Title  III 

■ Computer  Trespasser  exception. 

■ Consent  of  a party  to  the 
communication. 

■ Service  Provider  exception. 


Consent  of  a Party  to  the 
Communication  - the  Victim 
Computer 


Express  consent 


Consent  of  a Party  to  the 

Commiiniration  - Banners 


Implied  consent 


The  Computer  Trespasser  Exception 
(18  U.S.C.§2511(2)(i)) 


Requires: 

■ consent  of  the  computer  owner 


authorization. 


the  person  performing  the  intercept,  must  be 
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the  person  performing  the  intercept  must  have 
"reasonable  grouncjs  to  believe  the  contents  of  the 
communications  will  be  relevant  to  the 
Investigation." 
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The  Computer  Trespasser 
Exception  (continued) 


The  Computer  Trespasser 
— Exception  (continued) 

Another  legal  tip: 


The  Computer  Trespasser 
— Fxception  ^antinued) — 


Practice  tips: 


18  U.S,C.  2511(2)(a)(i) 


■ Authorizes  interception  or  disclosure  "while 
engaged  in  any  activity  which  is  a necessary 
incident  to  the  rendition  of  service  or  the 
protection  of  the  rights  or  property  of  the 
provider  of  the  service" 


Questions? 


Assistant  General  Counsel 
Science  & Technology  Law  Unit 
Engineering  Research  Facility 
Quantico,  VA 


Undelivered  email 
less  that  180 
days  old 

Stored  content 

Most  transactional 
Records  (net  flow  data) 

Basic  subscriber 
info,  and 
billing  records 


Search  warrant 

Subpoena  or  2703  order 
with  notice 
(or  search  warrant) 

2703(d)  order 
(or  search  warrant) 

Subpoena 
(or  2703(d)  order 
or  search  warrant) 


Program 


General  Uperational  Ciuidelities 


General  Operational  Guidelines 


General  Operational  Guidelines 


General  Operational  Guidelines 


Wake  up. 

JK. 

It’s  time  to  leave. 


